gifdec: reset previous Graphic Control Extension disposal type

This fixes out of array accesses.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d23b8462b5a4a9da78ed45c4a7a3b35d538df909)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-05-07 16:07:27 +02:00
parent 7ef2dbd239
commit 7ee5e97c46

View File

@ -462,6 +462,7 @@ static int gif_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, A
if (s->keyframe) {
s->keyframe_ok = 0;
s->gce_prev_disposal = GCE_DISPOSAL_NONE;
if ((ret = gif_read_header1(s)) < 0)
return ret;